PT-2026-35080

CVE-2026-6967

Published

2026-04-24

Updated

2026-10-20

Description by

CVSS 4.0

7.1

High

MetricsAV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:L

Name of the Vulnerable Software and Affected Versions tough versions prior to 0.22.0

Description Remote authenticated users with delegated signing authority can bypass TUF specification integrity checks for delegated targets metadata and poison the local metadata cache. This occurs because the load delegations() function does not apply the same validation checks regarding expiration, hash, and length enforcement as the top-level targets metadata path.

Recommendations Upgrade to version 0.22.0.

Exploitability

Exploit

Fix

Impacts

Researchers

1Seal

Vendors

Affected products

Weakness enumeration

CWE-345: Insufficient Verification of Data Authenticity

Related identifiers